232. Competent authorities should consider whether the internal audit function is effective and …

Competent authorities should consider whether the internal audit function is effective and possesses sufficient knowledge, skills and expertise to audit institution’s ICT risk management framework, by reviewing whether:

• a. the ICT risk management framework is audited with the required quality, focus and frequency, and is commensurate to the ICT risk profile of the institution;
• b. the audit plan includes audits on the material ICT risks identified by the institution, including independent reviews of ICT response and recovery plans;
• c. critical ICT audit findings are timely verified and remediated, including reporting to the management body;
• d. ICT audit findings, including agreed actions, are formally followed up and progress reports periodically reviewed by the senior management and/or the audit committee.

6.4.4. Assessment of reputational risk

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde standaarden

2. Geïdentificeerde eisen

3. Gerelateerde standaarden

• EBA -

  EN: Guidelines and other publications of the European Banking Authority (EBA), https://www.eba.europa.eu/. © European Banking Authority. Reproduction is authorised provided the source is acknowledged (EBA legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by the EBA are authoritative.

  DE: Leitlinien und weitere Veröffentlichungen der Europäischen Bankenaufsichtsbehörde (EBA), https://www.eba.europa.eu/. © European Banking Authority. Wiedergabe mit Quellenangabe gestattet (Rechtlicher Hinweis der EBA). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die von der EBA veröffentlichten Fassungen.